NEW YORK — For months, every developer who installed a plugin through Claude Code, OpenAI Codex, GitHub Copilot, or Gemini CLI was potentially one package away from giving an attacker unrestricted access to their machine.
That is the takeaway from Plugin4Shell, a zero-click supply-chain vulnerability disclosed Thursday by researchers at AIR Security. The flaw, discovered in May 2026 and quietly reported to affected vendors in June, exploits a gap in how AI coding agents handle git-based plugin installations, a gap that turns the very mechanism agents use to verify code integrity into a vector for silent compromise.
Three of the four affected vendors have patched. One hasn’t.
How it works
AI coding agents like Claude Code and GitHub Copilot install plugins by checking out specific git commit hashes, a practice designed to guarantee reproducibility. If a developer pins their plugin to commit abc123, the reasoning goes, they will always get exactly the same code, regardless of what happens to the repository’s main branch.
That assumption holds everywhere except one place: git hosting platforms that allow branch names to be identical to commit SHA hashes.
AIR Security researchers Or Nevo, Dor Granat, and Niv Hoffman found that when an agent receives an instruction to check out a pinned hash, it performs a git checkout by the name of that hash, not a verification of whether the code at that location actually matches the expected content. On a host permitting branch names formatted as SHAs, an attacker who controls the repository, or who can create a branch in a shared namespace, can redirect the checkout to an entirely different codebase.
Who was affected
The researchers confirmed Plugin4Shell in four products: Claude Code, OpenAI Codex, GitHub Copilot, and Google’s Gemini CLI. All four implemented git-based plugin installation. None of them, at the time of discovery, verified retrieved code against the pinned hash by content rather than by name.
Anthropic released Claude Code 2.1.179 on August 14 with a fix for the underlying checkout logic. The patch validates the retrieved tree object against the expected hash before execution, refusing to proceed if there is a mismatch. OpenAI shipped the same class of fix in Codex 0.146.0.
GitHub Copilot has not issued a patch as of the disclosure date. Microsoft confirmed the vulnerability is under active investigation but did not provide a remediation timeline. Google deprecated Gemini CLI prior to the disclosure and directed users to its successor product.
The exposure window between AIR Security’s June notification and the first patches ran more than two months. Neither Anthropic nor OpenAI disclosed any known exploitation during that period.
The trust assumption that failed
Plugin4Shell lands at a moment when the AI agent ecosystem is scaling faster than its security architecture. Anthropic, which has made security a priority alongside its substantial research investment, treats Claude Code as a flagship developer product whose enterprise prospects depend on trust in its safety posture. That posture becomes harder to maintain when the flaw is not some obscure edge case but the foundational mechanism used to verify package integrity.
SHA pinning is supposed to be the answer to supply-chain attacks. Plugin4Shell demonstrates that pinning by name and pinning by content are not the same thing, and that AI agents conflated the two.
The researchers note this is not a novel class of vulnerability. Similar name-versus-content confusion has appeared in container tooling and package managers before. What is new is the target: AI agents running with elevated system permissions inside live development environments. A compromised plugin in that context does not just affect a build artifact. It can exfiltrate source code, pivot to cloud infrastructure, or persist across sessions. For enterprises running AI coding agents at scale, that is not a theoretical concern. Automated pipelines that invoke agents on pull request triggers routinely operate without developer supervision, meaning a successful exploitation would not necessarily be noticed.
“The attack surface has quietly grown,” Nevo said in the AIR Security disclosure. “Agents have become very powerful. The verification story hasn’t kept up.”
What developers should do now
For Claude Code and Codex users, the immediate action is clear: update to the patched versions. For GitHub Copilot users, the picture is murkier. Microsoft has not confirmed a timeline, which leaves developers relying on Copilot’s plugin ecosystem in a window of undefined exposure.
Developers using any AI coding agent should audit their installed plugins for git-sourced packages and treat any plugin that ships environment access as requiring the same scrutiny as a production dependency. How quickly Microsoft ships a fix will say something about how seriously major AI vendors treat the security architecture around developer tools.
The more pressing question, which the AIR Security disclosure does not resolve, is how many similar assumptions remain baked into the broader agent ecosystem. Plugin4Shell is probably not the last one.
